CVE-2026-101885 is a High (CVSS 7.8) path traversal in ZeroClaw before 0.8.5 when built with the plugins-wasm feature. A crafted plugin can write files outside the plugins directory, which can lead to code execution. Upgrade to 0.8.5 or later, and install only plugins you trust.
What's affected
The weakness is CWE-22 (path traversal). The record says ZeroClaw before 0.8.5 is affected, and only when built with the plugins-wasm feature. The GitHub advisory says the same: affected builds are v0.8.4 and earlier with that feature, and v0.8.5 is the patched version.
The advisory says the lean official binary archives do not enable the plugins-wasm feature, so most users of those archives are not exposed. Source builds or custom builds with the feature turned on are the affected ones.
The flaw is in plugin installation. The install command copies a plugin file into the plugins directory using a path from the plugin manifest, wasm_path, without checking that the path stays inside the plugin directory. A malicious plugin package, either a local directory or one fetched from a registry, can set that path to climb out of the directory or use an absolute path. The result is an arbitrary file write with attacker chosen content.
The advisory adds that plugin signature verification is off by default, so no signature check stands between an untrusted package and the write. It gives examples of what an attacker might overwrite, such as shell startup files, which turns a file write into code execution. The CVSS vector requires user interaction, since a user must be convinced to install the plugin.
How to check if you're exposed
Check the version and the build features.
Read the version with the method your install uses, such as the binary's version output or your package inventory. If it is 0.8.4 or earlier, find out whether your binary was built with the plugins-wasm feature. If you use the official lean archives, the advisory says that feature is not enabled. If you build from source, check your build command and Cargo feature flags.
Then review installed plugins. List the plugins directory and compare it with what your team approved, and check for files in odd places such as shell profile files modified recently.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Upgrade ZeroClaw to 0.8.5 or later in every feature-enabled build.
- Install plugins only from sources you trust, and review the manifest of any plugin first.
- Turn on plugin signature verification if your version supports it. The advisory says it is off by default.
- Check shell startup files and autostart entries on machines where untrusted plugins were installed.
- Rebuild any custom binaries from the patched source, not just the lean archive.
Why it matters
Plugin systems pull code from outside the project, so the installer is a security boundary. Here the installer trusted a path field in a file supplied by the plugin author. Joining that path to a directory is not enough, because the result must be checked to still be inside the directory.
The supply chain angle is the real concern. People install plugins because a registry or a colleague suggests them. With signatures off, nothing else checks the package. The record does not mark the CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do the official ZeroClaw binaries have this problem?
The advisory says the lean official binary archives do not enable the plugins-wasm feature, so they are not affected by this path. Source or custom builds with the feature are.
Why did the advisory mention signatures?
Signature verification is off by default, so there was no signature gate between an untrusted package and the file write.
Sources
Last reviewed: 18 October 2026.
